valkyrjaio / valkyrja-starter-app-php / 30725634569
100%

DEFAULT BRANCH: 26.x
Ran
Jobs 1
Files 33
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 100.0%. Remained the same
30725634569

push

github

web-flow 
[Workflow] ci: Pass each reusable workflow the secrets it declares (#217)

# Description

Every caller in this repository passed `secrets: inherit`. That hands
the called
workflow all eight organization secrets, whatever the workflow needs.
SonarCloud
flags the pattern.

Each job now passes the exact list that the workflow it calls declares.

This is the consumer half of

[valkyrjaio/.github#219](https://github.com/valkyrjaio/.github/pull/219),
which
added an `on.workflow_call.secrets` block to each reusable workflow.
That change
is in v26.19.0, and this repository already pins that release, so each
name below
is one the pinned workflow declares.

## How the list was derived

For each job, the list was read from the called workflow **at the SHA
this
repository pins**, not from a copy. A name that the pinned workflow does
not
declare therefore cannot appear here. GitHub rejects such a name with
`Invalid input`, so the check is not cosmetic.

`GITHUB_TOKEN` appears in no list. GitHub gives it to a called workflow
automatically, and the `GITHUB_` prefix is reserved, so a workflow
cannot declare
it.

## A defect this fixes

`cherry-pick-commits.yml` passed **no** `secrets:` key, and
`_cherry-pick-commits.yml` mints an app token unconditionally. The job
failed at
`create-github-app-token` with an empty `app-id`. The workflow runs only
on
`workflow_dispatch`, so nothing exercised it and the failure stayed
hidden. This
pull request adds the key, so the job can mint its token.

## Verification

The same change is green in

[valkyrjaio/valkyrja-php#1103](https://github.com/valkyrjaio/valkyrja-php/pull/1103),
where all 14 checks passed. That run proves the callers a pull request
triggers:
`ci.yml`, `pr.yml`, and `claude-review.yml`.

A pull request cannot start the other callers, because a release event
or a
manual dispatch starts them. Those callers stay unexercised until
someone runs
them.

## Types of changes

- [x] Improvement _(non-breaking change which im... (continued)

517 of 517 relevant lines covered (100.0%)

2.12 hits per line

Jobs
ID Job ID Ran Files Coverage
1 30725634569.1 33
100.0
 GitHub Action Run
Source Files on build 30725634569